CVE-2026-64670

The @waline/client comment system (versions 3.15.2 and prior ) is vulnerable to Stored XSS due to an unsanitized markdown preview in the comment editor. The application renders the comment body using marked without a sanitizer in utils/markdown.ts and injects the result via v-html. When a comment...

PT-2026-144972

Name of the Vulnerable Software and Affected Versions Waline versions prior to 3.15.3 Description A stored Cross-Site Scripting XSS issue exists in the @waline/client component. The system renders the comment editor's live preview using the marked library without a sanitizer in utils/markdown.ts,...

CVE-2026-64670: walinejs waline: Waline is a comment system with backend support

Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer utils/markdown.ts, and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw,...